c0d678478b68084c7750369ddcdfb1afd13aae114ece242cae06dc7a34a84ca9

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29-06-2024 20:37

Target

bc6c2fda18f8ee36930b469f6500e28096eb6795e5fd17c44273c67bc9fa6a6d.dll
Size

24KB
MD5

e57f8364372e3ba866389c2895b42628
SHA1

fb29f04fb4ffb71f623481cffe221407e2256e0a
SHA256

bc6c2fda18f8ee36930b469f6500e28096eb6795e5fd17c44273c67bc9fa6a6d
SHA512

501bbb4025a5629d4c83857baa83ca8269954b2bb9fb116f09d60bed72844dedbad17dd8449812c574d61246099736a5c6100f68ba4c9b57da0f9bf79a89f27f
SSDEEP

96:DLpi9HhxOJlqsc6ylzo/GrTE3VegdA3dOqgi:sH+3qsc6azzs3VTidOqg

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2328	2036	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 2036	2044	rundll32.exe	28
PID 2044 wrote to memory of 2036	2044	rundll32.exe	28
PID 2044 wrote to memory of 2036	2044	rundll32.exe	28
PID 2044 wrote to memory of 2036	2044	rundll32.exe	28
PID 2044 wrote to memory of 2036	2044	rundll32.exe	28
PID 2044 wrote to memory of 2036	2044	rundll32.exe	28
PID 2044 wrote to memory of 2036	2044	rundll32.exe	28
PID 2036 wrote to memory of 2328	2036	rundll32.exe	29
PID 2036 wrote to memory of 2328	2036	rundll32.exe	29
PID 2036 wrote to memory of 2328	2036	rundll32.exe	29
PID 2036 wrote to memory of 2328	2036	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bc6c2fda18f8ee36930b469f6500e28096eb6795e5fd17c44273c67bc9fa6a6d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bc6c2fda18f8ee36930b469f6500e28096eb6795e5fd17c44273c67bc9fa6a6d.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2036
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 224
    3⤵
    - Program crash
    PID:2328